OAuthLib is an OAuth request-signing library for Python. From version 3.3.0 up to, but excluding, 4.0.1, the device flow implementation does not validate the device_code provided to the token endpoint when a client requests a token. A caller who knows a legitimate client ID can instead supply an empty or arbitrary device_code and still receive an access token, thereby bypassing the intended device authorization procedure. This results in unauthorized access to any resources the token scopes allow, making it an authentication bypass vulnerability classified as CWE‑287.

The flaw exists in OAuthLib, a widely used OAuth 2.0 abstraction for Python projects. Any deployment that relies on OAuthLib versions from 3.3.0 through 4.0.1 is susceptible. The issue affects applications running on Python 3.6 and later that use the device authorization grant flow.

The flaw carries a CVSS score of 8.5, indicating high severity, but no EPSS score is available so current exploitation likelihood is unknown. It is not listed in the CISA KEV catalog. Exploitation requires only knowledge of a valid client ID, which is often publicly visible or discoverable, and access to the OAuth token endpoint, making it a realistic network‑based attack. Once an attacker obtains a bearer token, they can act with all permissions granted to the client, constituting a serious threat to confidentiality, integrity, and availability.